Cybercrime Dipped During Holiday Shopping Season

Black Friday through Cyber Monday traditionally has been the most vulnerable time for many businesses -- especially retailers -- for cyberattacks, but new data from IBM shows that attacks against all industries during that period in 2014 actually decreased 50% from the previous two years.

But that doesn't mean the bad guys took an extended holiday. From Nov. 24 through Dec. 5, IBM's Managed Security Services saw 3,043 cyberattack attempts per day against client organizations in various industries, versus an average of 4,200 during that period in 2013. IBM says there were 10 breaches reported during the 2014 holiday season, versus more than 20 last year.

How did retailers fare during their vulnerable holiday shopping season, when no new security tools or other IT projects go live and only the most critical security patches get installed? According to IBM, two retailers reported breaches during that period, versus three in 2013.

Just why cybercrime actually dropped during the retail industry's self-imposed technology "freeze" period -- holiday shopping season -- is unclear. "That's when [a company] really looks ripe for the picking, when they start freezing patches and security starts to take a back seat" to transactions and system availability, says John Kuhn, senior threat researcher for IBM Managed Security Services. "But historically, it didn't show attackers taking advantage of that… I can't really say why they are not taking advantage of that time period."

One possibility, according to IBM's report, is that attackers performed the bigger heists before that period in order to cash out more quickly, before banks catch on that payment cards have been dumped in the cyber underground. "Often, attackers infiltrate targeted systems and then spend months stealthily collecting data before any announcement is made or the organization becomes privy to the compromise."

Meanwhile, the number of retailers hit by data breaches in 2014 actually dropped by 50%. But cybercriminals were actually more efficient in their attacks against retailers, getting more bang for their buck, with 61 million of records compromised last year, down from nearly 73 million in 2013 -- a figure mainly attributed to Target's massive breach that year. When you take Target and the Home Depot -- the two largest attacks in terms of stolen records -- out of the equation, the number of stolen retail records in 2014 increased by more than 43% over 2013.

"Last year, we saw a lot of breaches of big high-profile names. This [past] year, we saw a decline in the number of breaches during the holiday period, but a rise in the volume of records" stolen, Chris Strand, senior director of compliance for Bit9 + Carbon Black, said of the IBM report. "The volume of records they're getting is increasing over the years."

And some retailers may not yet know they've been infiltrated with malware, whether it was planted during the holiday shopping season or afterward. "A lot of attacks during the holiday last year were uncovered later," Strand says. Plus, attackers could be hacking through different vectors now that their methods of attack, such as PoS malware, have been publicized broadly.

Arthur Tisi, a retail security expert and co-founder and CEO of The Praescripto Group LLC, says the bottom line is that the risk to retailers is still very real. "In aggregate, there were fewer instances [of attacks], but the instances are more dramatic."

Retailers are improving their security and awareness after the past year and a half of high-profile breaches, he says. "When you start having C-level executives losing jobs, you start to become more aware. But there's an extremely long tail here," and retailers remain at risk.

According to IBM: "Ironically, while the number of records reported has increased, the number of total breaches reported has decreased since 2012. The number is down over 50% currently in 2014 from its peak in 2012. This means that, while we have seen fewer breaches reported in the last two years, these breaches were significant and wide-reaching in terms of victims affected."

IBM also found that manufacturing was the most attacked industry during the holidays in 2012 and 2013. The retail and wholesale industries were the most targeted in 2014.

POS malware not No. 1
Malware written to attack point-of-sale (POS) systems emerged en masse last year, but POS malware was not the No. 1 attack vector in retail breaches, IBM found. Injection attacks -- command or SQL injection -- were the most common means of attack. Command injection was the attack vector in nearly 6,000 retail attack attempts. IBM said systems administrators are not performing data validation: "Shellcode characters should never be allowed to enter an organization's network via HTTP."

Strand says that injection attacks are indeed on the rise, and that will continue as attackers set their sights more on e-commerce retail, especially as POS vendors and retailers better lock down the POS systems. "Attacks will shift further to e-commerce, and threat numbers and attempts at e-commerce are going to rise." Command injection attacks can work against POS systems, but they also will be used to go after e-commerce sites.

Happy New Breach Year
IBM's Kuhn expects cybercriminals to continue hacking away at large retailers, but small ones will be even more at risk as the big guys shore up security. "It will be a little of both" getting hit this year. "The guys who do this to smaller retailers are going to continue what they're doing because it's effective… As more defenses come into play, they will have to be more crafty" against large retailers.